GitHub Advisoryadvisory · PyPI

GHSA-wf93-45jw-7689 pip: Path traversal in console_scripts/gui_scripts entry point names allows installing scripts outside of target directory

MEDIUM Published 2026-06-01 Modified 2026-07-10 Official page ↗
Aliases
CVE-2026-8643
Ecosystem
PyPI
Packages
pip
Severity
Moderate
CVSS vector
CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:U/C:H/I:H/A:H
Weaknesses
CWE-22
Reviewed
2026-07-08

Affected packages

• PyPI pip: < 26.1.2 → fixed in 26.1.2

Description

pip would treat console_scripts and gui_scripts as paths instead of file names without sanitizing the resolved absolute path to the installation directory, leading to entry points being installed outside the installation directory.

Related

Alias · CVE (1)

  • CVE-2026-8643 pip would treat console_scripts and gui_scripts as paths instead of file names without sanitizing the resolved absolute path to the… vulnerability

Weakness · CWE (1)

  • CWE-22 Improper Limitation of a Pathname to a Restricted Directory weakness

References